var-202001-1433

Vulnerability from variot

When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 68.3, Firefox ESR < 68.3, and Firefox < 71.

Background

The Mozilla Network Security Service (NSS) is a library implementing security features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11, PKCS #12, S/MIME and X.509 certificates. ========================================================================== Ubuntu Security Notice USN-4203-1 November 27, 2019

nss vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 19.10
Ubuntu 19.04
Ubuntu 18.04 LTS
Ubuntu 16.04 LTS

Summary:

NSS could be made to crash or run programs if it received specially crafted input.

Update instructions:

The problem can be corrected by updating your system to the following package versions:

Ubuntu 19.10: libnss3 2:3.45-1ubuntu2.1

Ubuntu 19.04: libnss3 2:3.42-1ubuntu2.3

Ubuntu 18.04 LTS: libnss3 2:3.35-2ubuntu2.5

Ubuntu 16.04 LTS: libnss3 2:3.28.4-0ubuntu0.16.04.8

After a standard system update you need to restart any applications that use NSS, such as Evolution, to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: nss-softokn security update Advisory ID: RHSA-2020:1461-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2020:1461 Issue date: 2020-04-14 CVE Names: CVE-2018-0495 CVE-2019-11745 ==================================================================== 1. Summary:

An update for nss-softokn is now available for Red Hat Enterprise Linux 7.6 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) - x86_64 Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) - x86_64 Red Hat Enterprise Linux Server EUS (v. 7.6) - ppc64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x

Description:

The nss-softokn package provides the Network Security Services Softoken Cryptographic Module.

Security Fix(es):

nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate (CVE-2019-11745)
ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries (CVE-2018-0495)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution:

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

1591163 - CVE-2018-0495 ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries 1774831 - CVE-2019-11745 nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate

Package List:

Red Hat Enterprise Linux ComputeNode EUS (v. 7.6):

Source: nss-softokn-3.36.0-6.el7_6.src.rpm

Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6):

x86_64: nss-softokn-debuginfo-3.36.0-6.el7_6.i686.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.x86_64.rpm nss-softokn-devel-3.36.0-6.el7_6.i686.rpm nss-softokn-devel-3.36.0-6.el7_6.x86_64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.i686.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.x86_64.rpm

Red Hat Enterprise Linux Server EUS (v. 7.6):

Source: nss-softokn-3.36.0-6.el7_6.src.rpm

ppc64: nss-softokn-3.36.0-6.el7_6.ppc.rpm nss-softokn-3.36.0-6.el7_6.ppc64.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.ppc.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.ppc64.rpm nss-softokn-devel-3.36.0-6.el7_6.ppc.rpm nss-softokn-devel-3.36.0-6.el7_6.ppc64.rpm nss-softokn-freebl-3.36.0-6.el7_6.ppc.rpm nss-softokn-freebl-3.36.0-6.el7_6.ppc64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.ppc.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.ppc64.rpm

ppc64le: nss-softokn-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-devel-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-freebl-3.36.0-6.el7_6.ppc64le.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.ppc64le.rpm

s390x: nss-softokn-3.36.0-6.el7_6.s390.rpm nss-softokn-3.36.0-6.el7_6.s390x.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.s390.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.s390x.rpm nss-softokn-devel-3.36.0-6.el7_6.s390.rpm nss-softokn-devel-3.36.0-6.el7_6.s390x.rpm nss-softokn-freebl-3.36.0-6.el7_6.s390.rpm nss-softokn-freebl-3.36.0-6.el7_6.s390x.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.s390.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.s390x.rpm

x86_64: nss-softokn-3.36.0-6.el7_6.i686.rpm nss-softokn-3.36.0-6.el7_6.x86_64.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.i686.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.x86_64.rpm nss-softokn-devel-3.36.0-6.el7_6.i686.rpm nss-softokn-devel-3.36.0-6.el7_6.x86_64.rpm nss-softokn-freebl-3.36.0-6.el7_6.i686.rpm nss-softokn-freebl-3.36.0-6.el7_6.x86_64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.i686.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.x86_64.rpm

Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):

Source: nss-softokn-3.36.0-6.el7_6.src.rpm

aarch64: nss-softokn-3.36.0-6.el7_6.aarch64.rpm nss-softokn-debuginfo-3.36.0-6.el7_6.aarch64.rpm nss-softokn-devel-3.36.0-6.el7_6.aarch64.rpm nss-softokn-freebl-3.36.0-6.el7_6.aarch64.rpm nss-softokn-freebl-devel-3.36.0-6.el7_6.aarch64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2018-0495 https://access.redhat.com/security/cve/CVE-2019-11745 https://access.redhat.com/security/updates/classification/#important

Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

iQIVAwUBXpX1/NzjgjWX9erEAQgbgA//cmjPu8TwMWsHonboOmXKQZTXbtfVVgo/ 9T/YTJetV/4T3D+cWon1eMLwkZ11OWZHKxvsOfNqcx+DEVa0CwmVVrvBzqzejMkg uuRnfU0ULemUIVBbnFRuN5wvzlrbarUmoilC1uqE/8AxJKtvoAiU0m5Pbcs2je65 r3EcOqwqYSLoI2t6zxU7IGvKI1utG3ZnY5b4DFzMAVrLn0DK0PhKv29ijBWB4S3e haoxib7lehCEPjY35la6ZugC8VUYAjyRlVEnMXLi8Tm0jWcxM5tU+j9F1rsufk2H /Ll3ZMnHfrnlR9Eo0hkiGWGr7zgEerkKfpmrajj00Hziet4DAa9VIDiHqgP5gicl beAnXIczzXQ0mhgrgFZMObXnxpCEDOhO0AWWfmKfj/dcp5lcclZtClNL0ae0Z9d6 RURuVbgeTlYcRASwW7BkKpFMVWzk8LkusA2xuweHv61R/GarOr759tzsLBapb7at vfG2gfBw2CCxILBObT0BsqiDAXpvyS/WlFq19qwLgEc7fLvBc9+2bij66SpB+EeJ IK6xC4WJz+Cn/Tk93xwYj0oFWU5f6H84oL2niKBwtZRorJAoyGcYCqBa0dlMiASO N4sG2/9byTUmmDGW4UMpheMAgDx8UJWdiLIy9WnduZOUWyzzkJ/ms5kyJlG84nBS IAT4DyTF7E0=RrKW -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . 7.4) - x86_64

Gentoo Linux Security Advisory GLSA 202003-02

                                       https://security.gentoo.org/

Severity: Normal Title: Mozilla Firefox: Multiple vulnerabilities Date: March 12, 2020 Bugs: #702638, #705000, #709346, #712182 ID: 202003-02

Synopsis

Multiple vulnerabilities have been found in Mozilla Firefox, the worst of which may allow execution of arbitrary code.

Background

Mozilla Firefox is a popular open-source web browser from the Mozilla Project.

Affected packages

-------------------------------------------------------------------
 Package              /     Vulnerable     /            Unaffected
-------------------------------------------------------------------

1 www-client/firefox < 68.6.0 >= 68.6.0 2 www-client/firefox-bin < 68.6.0 >= 68.6.0 ------------------------------------------------------------------- 2 affected packages

Description

Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details.

Impact

A remote attacker could entice a user to view a specially crafted web page, possibly resulting in the execution of arbitrary code with the privileges of the process or a Denial of Service condition. Furthermore, a remote attacker may be able to perform Man-in-the-Middle attacks, obtain sensitive information, spoof the address bar, conduct clickjacking attacks, bypass security restrictions and protection mechanisms, or have other unspecified impact.

Workaround

There is no known workaround at this time.

Resolution

All Mozilla Firefox users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-68.6.0"

All Mozilla Firefox binary users should upgrade to the latest version:

# emerge --sync # emerge --ask --oneshot --verbose ">=www-client/firefox-bin-68.6.0"

References

[ 1 ] CVE-2019-11745 https://nvd.nist.gov/vuln/detail/CVE-2019-11745 [ 2 ] CVE-2019-17005 https://nvd.nist.gov/vuln/detail/CVE-2019-17005 [ 3 ] CVE-2019-17008 https://nvd.nist.gov/vuln/detail/CVE-2019-17008 [ 4 ] CVE-2019-17010 https://nvd.nist.gov/vuln/detail/CVE-2019-17010 [ 5 ] CVE-2019-17011 https://nvd.nist.gov/vuln/detail/CVE-2019-17011 [ 6 ] CVE-2019-17012 https://nvd.nist.gov/vuln/detail/CVE-2019-17012 [ 7 ] CVE-2019-17016 https://nvd.nist.gov/vuln/detail/CVE-2019-17016 [ 8 ] CVE-2019-17017 https://nvd.nist.gov/vuln/detail/CVE-2019-17017 [ 9 ] CVE-2019-17022 https://nvd.nist.gov/vuln/detail/CVE-2019-17022 [ 10 ] CVE-2019-17024 https://nvd.nist.gov/vuln/detail/CVE-2019-17024 [ 11 ] CVE-2019-17026 https://nvd.nist.gov/vuln/detail/CVE-2019-17026 [ 12 ] CVE-2019-20503 https://nvd.nist.gov/vuln/detail/CVE-2019-20503 [ 13 ] CVE-2020-6796 https://nvd.nist.gov/vuln/detail/CVE-2020-6796 [ 14 ] CVE-2020-6797 https://nvd.nist.gov/vuln/detail/CVE-2020-6797 [ 15 ] CVE-2020-6798 https://nvd.nist.gov/vuln/detail/CVE-2020-6798 [ 16 ] CVE-2020-6799 https://nvd.nist.gov/vuln/detail/CVE-2020-6799 [ 17 ] CVE-2020-6800 https://nvd.nist.gov/vuln/detail/CVE-2020-6800 [ 18 ] CVE-2020-6805 https://nvd.nist.gov/vuln/detail/CVE-2020-6805 [ 19 ] CVE-2020-6806 https://nvd.nist.gov/vuln/detail/CVE-2020-6806 [ 20 ] CVE-2020-6807 https://nvd.nist.gov/vuln/detail/CVE-2020-6807 [ 21 ] CVE-2020-6811 https://nvd.nist.gov/vuln/detail/CVE-2020-6811 [ 22 ] CVE-2020-6812 https://nvd.nist.gov/vuln/detail/CVE-2020-6812 [ 23 ] CVE-2020-6814 https://nvd.nist.gov/vuln/detail/CVE-2020-6814 [ 24 ] MFSA-2019-37 https://www.mozilla.org/en-US/security/advisories/mfsa2019-37/ [ 25 ] MFSA-2020-03 https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/ [ 26 ] MFSA-2020-06 https://www.mozilla.org/en-US/security/advisories/mfsa2020-06/ [ 27 ] MFSA-2020-09 https://www.mozilla.org/en-US/security/advisories/mfsa2020-09/

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website:

https://security.gentoo.org/glsa/202003-02

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.

License

The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.

https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1

[slackware-security] mozilla-firefox (SSA:2019-337-01)

New mozilla-firefox packages are available for Slackware 14.2 and -current to fix security issues.

Here are the details from the Slackware 14.2 ChangeLog: +--------------------------+ patches/packages/mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz: Upgraded. This release contains security fixes and improvements. For more information, see: https://www.mozilla.org/en-US/firefox/68.3.0/releasenotes/ https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html https://www.mozilla.org/security/advisories/mfsa2019-37/ https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17008 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13722 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17009 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17010 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17005 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17011 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17012 ( Security fix ) +--------------------------+

Where to find the new packages: +-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab (http://osuosl.org) for donating FTP and rsync hosting to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for additional mirror sites near you.

Updated package for Slackware 14.2: ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz

Updated package for Slackware x86_64 14.2: ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mozilla-firefox-68.3.0esr-x86_64-1_slack14.2.txz

Updated package for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-firefox-68.3.0esr-i686-1.txz

Updated package for Slackware x86_64 -current: ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-firefox-68.3.0esr-x86_64-1.txz

MD5 signatures: +-------------+

Slackware 14.2 package: 87f700f9d6e2f2714f34bd4df98daff3 mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz

Slackware x86_64 14.2 package: a1fc7f2d55d99552fbfef89c0a4fc4d8 mozilla-firefox-68.3.0esr-x86_64-1_slack14.2.txz

Slackware -current package: b398fbd95c214bc1f209344809557650 xap/mozilla-firefox-68.3.0esr-i686-1.txz

Slackware x86_64 -current package: 54fdcfaa0337054003900c366020e39f xap/mozilla-firefox-68.3.0esr-x86_64-1.txz

Installation instructions: +------------------------+

Upgrade the package as root:

upgradepkg mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz

+-----+

Slackware Linux Security Team http://slackware.com/gpg-key security@slackware.com

+------------------------------------------------------------------------+ | To leave the slackware-security mailing list: | +------------------------------------------------------------------------+ | Send an email to majordomo@slackware.com with this text in the body of | | the email message: | | | | unsubscribe slackware-security | | | | You will get a confirmation message back containing instructions to | | complete the process. Please do not reply to this email address

Show details on source website

JSON

To clipboard

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-202001-1433",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "firefox",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "71.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "18.04"
      },
      {
        "model": "enterprise linux server aus",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "redhat",
        "version": "6.6"
      },
      {
        "model": "leap",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "opensuse",
        "version": "15.1"
      },
      {
        "model": "ruggedcom rox rx1400",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox rx1501",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox rx1510",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox mx5000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "firefox esr",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "68.3"
      },
      {
        "model": "linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "debian",
        "version": "9.0"
      },
      {
        "model": "ruggedcom rox rx1500",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "19.10"
      },
      {
        "model": "ruggedcom rox rx5000",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ruggedcom rox rx1512",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      },
      {
        "model": "ubuntu linux",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "canonical",
        "version": "16.04"
      },
      {
        "model": "thunderbird",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "mozilla",
        "version": "68.3.0"
      },
      {
        "model": "ruggedcom rox rx1511",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "siemens",
        "version": "2.14.0"
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "71.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "68.3",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "68.3.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:redhat:enterprise_linux_server_aus:6.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_mx5000_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.14.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_mx5000:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_rx1400_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.14.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_rx1400:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_rx1500_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.14.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_rx1500:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_rx1501_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.14.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_rx1501:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_rx1510_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.14.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_rx1510:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_rx1511_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.14.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_rx1511:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_rx1512_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.14.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_rx1512:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          },
          {
            "children": [
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:o:siemens:ruggedcom_rox_rx5000_firmware:*:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "versionEndExcluding": "2.14.0",
                    "vulnerable": true
                  }
                ],
                "operator": "OR"
              },
              {
                "children": [],
                "cpe_match": [
                  {
                    "cpe23Uri": "cpe:2.3:h:siemens:ruggedcom_rox_rx5000:-:*:*:*:*:*:*:*",
                    "cpe_name": [],
                    "vulnerable": false
                  }
                ],
                "operator": "OR"
              }
            ],
            "cpe_match": [],
            "operator": "AND"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Ubuntu,Red Hat,Craig Disselkoen,Slackware Security Team,Gentoo",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2019-11745",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": true,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULMON",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 8.6,
            "id": "CVE-2019-11745",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "MEDIUM",
            "trust": 0.1,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "NVD",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 1.0,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2019-11745",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201911-1371",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULMON",
            "id": "CVE-2019-11745",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-11745"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71. \n\nBackground\n==========\n\nThe Mozilla Network Security Service (NSS) is a library implementing\nsecurity features like SSL v.2/v.3, TLS, PKCS #5, PKCS #7, PKCS #11,\nPKCS #12, S/MIME and X.509 certificates. ==========================================================================\nUbuntu Security Notice USN-4203-1\nNovember 27, 2019\n\nnss vulnerability\n==========================================================================\n\nA security issue affects these releases of Ubuntu and its derivatives:\n\n- Ubuntu 19.10\n- Ubuntu 19.04\n- Ubuntu 18.04 LTS\n- Ubuntu 16.04 LTS\n\nSummary:\n\nNSS could be made to crash or run programs if it received specially crafted\ninput. \n\nUpdate instructions:\n\nThe problem can be corrected by updating your system to the following\npackage versions:\n\nUbuntu 19.10:\n  libnss3                         2:3.45-1ubuntu2.1\n\nUbuntu 19.04:\n  libnss3                         2:3.42-1ubuntu2.3\n\nUbuntu 18.04 LTS:\n  libnss3                         2:3.35-2ubuntu2.5\n\nUbuntu 16.04 LTS:\n  libnss3                         2:3.28.4-0ubuntu0.16.04.8\n\nAfter a standard system update you need to restart any applications that\nuse NSS, such as Evolution, to make all the necessary changes. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n====================================================================                   \nRed Hat Security Advisory\n\nSynopsis:          Important: nss-softokn security update\nAdvisory ID:       RHSA-2020:1461-01\nProduct:           Red Hat Enterprise Linux\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2020:1461\nIssue date:        2020-04-14\nCVE Names:         CVE-2018-0495 CVE-2019-11745\n====================================================================\n1. Summary:\n\nAn update for nss-softokn is now available for Red Hat Enterprise Linux 7.6\nExtended Update Support. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Enterprise Linux ComputeNode EUS (v. 7.6) - x86_64\nRed Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) - x86_64\nRed Hat Enterprise Linux Server EUS (v. 7.6) - ppc64, ppc64le, s390x, x86_64\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) - aarch64, ppc64le, s390x\n\n3. Description:\n\nThe nss-softokn package provides the Network Security Services Softoken\nCryptographic Module. \n\nSecurity Fix(es):\n\n* nss: Out-of-bounds write when passing an output buffer smaller than the\nblock size to NSC_EncryptUpdate (CVE-2019-11745)\n\n* ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries\n(CVE-2018-0495)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nFor details on how to apply this update, which includes the changes\ndescribed in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1591163 - CVE-2018-0495 ROHNP: Key Extraction Side Channel in Multiple Crypto Libraries\n1774831 - CVE-2019-11745 nss: Out-of-bounds write when passing an output buffer smaller than the block size to NSC_EncryptUpdate\n\n6. Package List:\n\nRed Hat Enterprise Linux ComputeNode EUS (v. 7.6):\n\nSource:\nnss-softokn-3.36.0-6.el7_6.src.rpm\n\nx86_64:\nnss-softokn-3.36.0-6.el7_6.i686.rpm\nnss-softokn-3.36.0-6.el7_6.x86_64.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.i686.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.x86_64.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.i686.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6):\n\nx86_64:\nnss-softokn-debuginfo-3.36.0-6.el7_6.i686.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.x86_64.rpm\nnss-softokn-devel-3.36.0-6.el7_6.i686.rpm\nnss-softokn-devel-3.36.0-6.el7_6.x86_64.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.i686.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux Server EUS (v. 7.6):\n\nSource:\nnss-softokn-3.36.0-6.el7_6.src.rpm\n\nppc64:\nnss-softokn-3.36.0-6.el7_6.ppc.rpm\nnss-softokn-3.36.0-6.el7_6.ppc64.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.ppc.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.ppc64.rpm\nnss-softokn-devel-3.36.0-6.el7_6.ppc.rpm\nnss-softokn-devel-3.36.0-6.el7_6.ppc64.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.ppc.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.ppc64.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.ppc.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.ppc64.rpm\n\nppc64le:\nnss-softokn-3.36.0-6.el7_6.ppc64le.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.ppc64le.rpm\nnss-softokn-devel-3.36.0-6.el7_6.ppc64le.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.ppc64le.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.ppc64le.rpm\n\ns390x:\nnss-softokn-3.36.0-6.el7_6.s390.rpm\nnss-softokn-3.36.0-6.el7_6.s390x.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.s390.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.s390x.rpm\nnss-softokn-devel-3.36.0-6.el7_6.s390.rpm\nnss-softokn-devel-3.36.0-6.el7_6.s390x.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.s390.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.s390x.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.s390.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.s390x.rpm\n\nx86_64:\nnss-softokn-3.36.0-6.el7_6.i686.rpm\nnss-softokn-3.36.0-6.el7_6.x86_64.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.i686.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.x86_64.rpm\nnss-softokn-devel-3.36.0-6.el7_6.i686.rpm\nnss-softokn-devel-3.36.0-6.el7_6.x86_64.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.i686.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.x86_64.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.i686.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.x86_64.rpm\n\nRed Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7):\n\nSource:\nnss-softokn-3.36.0-6.el7_6.src.rpm\n\naarch64:\nnss-softokn-3.36.0-6.el7_6.aarch64.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.aarch64.rpm\nnss-softokn-devel-3.36.0-6.el7_6.aarch64.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.aarch64.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.aarch64.rpm\n\nppc64le:\nnss-softokn-3.36.0-6.el7_6.ppc64le.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.ppc64le.rpm\nnss-softokn-devel-3.36.0-6.el7_6.ppc64le.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.ppc64le.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.ppc64le.rpm\n\ns390x:\nnss-softokn-3.36.0-6.el7_6.s390.rpm\nnss-softokn-3.36.0-6.el7_6.s390x.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.s390.rpm\nnss-softokn-debuginfo-3.36.0-6.el7_6.s390x.rpm\nnss-softokn-devel-3.36.0-6.el7_6.s390.rpm\nnss-softokn-devel-3.36.0-6.el7_6.s390x.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.s390.rpm\nnss-softokn-freebl-3.36.0-6.el7_6.s390x.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.s390.rpm\nnss-softokn-freebl-devel-3.36.0-6.el7_6.s390x.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2018-0495\nhttps://access.redhat.com/security/cve/CVE-2019-11745\nhttps://access.redhat.com/security/updates/classification/#important\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXpX1/NzjgjWX9erEAQgbgA//cmjPu8TwMWsHonboOmXKQZTXbtfVVgo/\n9T/YTJetV/4T3D+cWon1eMLwkZ11OWZHKxvsOfNqcx+DEVa0CwmVVrvBzqzejMkg\nuuRnfU0ULemUIVBbnFRuN5wvzlrbarUmoilC1uqE/8AxJKtvoAiU0m5Pbcs2je65\nr3EcOqwqYSLoI2t6zxU7IGvKI1utG3ZnY5b4DFzMAVrLn0DK0PhKv29ijBWB4S3e\nhaoxib7lehCEPjY35la6ZugC8VUYAjyRlVEnMXLi8Tm0jWcxM5tU+j9F1rsufk2H\n/Ll3ZMnHfrnlR9Eo0hkiGWGr7zgEerkKfpmrajj00Hziet4DAa9VIDiHqgP5gicl\nbeAnXIczzXQ0mhgrgFZMObXnxpCEDOhO0AWWfmKfj/dcp5lcclZtClNL0ae0Z9d6\nRURuVbgeTlYcRASwW7BkKpFMVWzk8LkusA2xuweHv61R/GarOr759tzsLBapb7at\nvfG2gfBw2CCxILBObT0BsqiDAXpvyS/WlFq19qwLgEc7fLvBc9+2bij66SpB+EeJ\nIK6xC4WJz+Cn/Tk93xwYj0oFWU5f6H84oL2niKBwtZRorJAoyGcYCqBa0dlMiASO\nN4sG2/9byTUmmDGW4UMpheMAgDx8UJWdiLIy9WnduZOUWyzzkJ/ms5kyJlG84nBS\nIAT4DyTF7E0=RrKW\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. 7.4) - x86_64\n\n3. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\nGentoo Linux Security Advisory                           GLSA 202003-02\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n                                           https://security.gentoo.org/\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\n Severity: Normal\n    Title: Mozilla Firefox: Multiple vulnerabilities\n     Date: March 12, 2020\n     Bugs: #702638, #705000, #709346, #712182\n       ID: 202003-02\n\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\n\nSynopsis\n========\n\nMultiple vulnerabilities have been found in Mozilla Firefox, the worst\nof which may allow execution of arbitrary code. \n\nBackground\n==========\n\nMozilla Firefox is a popular open-source web browser from the Mozilla\nProject. \n\nAffected packages\n=================\n\n    -------------------------------------------------------------------\n     Package              /     Vulnerable     /            Unaffected\n    -------------------------------------------------------------------\n  1  www-client/firefox           \u003c 68.6.0                  \u003e= 68.6.0\n  2  www-client/firefox-bin       \u003c 68.6.0                  \u003e= 68.6.0\n    -------------------------------------------------------------------\n     2 affected packages\n\nDescription\n===========\n\nMultiple vulnerabilities have been discovered in Mozilla Firefox. \nPlease review the CVE identifiers referenced below for details. \n\nImpact\n======\n\nA remote attacker could entice a user to view a specially crafted web\npage, possibly resulting in the execution of arbitrary code with the\nprivileges of the process or a Denial of Service condition. \nFurthermore, a remote attacker may be able to perform Man-in-the-Middle\nattacks, obtain sensitive information, spoof the address bar, conduct\nclickjacking attacks, bypass security restrictions and protection\nmechanisms, or have other unspecified impact. \n\nWorkaround\n==========\n\nThere is no known workaround at this time. \n\nResolution\n==========\n\nAll Mozilla Firefox users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=www-client/firefox-68.6.0\"\n\nAll Mozilla Firefox binary users should upgrade to the latest version:\n\n  # emerge --sync\n  # emerge --ask --oneshot --verbose \"\u003e=www-client/firefox-bin-68.6.0\"\n\nReferences\n==========\n\n[  1 ] CVE-2019-11745\n       https://nvd.nist.gov/vuln/detail/CVE-2019-11745\n[  2 ] CVE-2019-17005\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17005\n[  3 ] CVE-2019-17008\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17008\n[  4 ] CVE-2019-17010\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17010\n[  5 ] CVE-2019-17011\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17011\n[  6 ] CVE-2019-17012\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17012\n[  7 ] CVE-2019-17016\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17016\n[  8 ] CVE-2019-17017\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17017\n[  9 ] CVE-2019-17022\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17022\n[ 10 ] CVE-2019-17024\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17024\n[ 11 ] CVE-2019-17026\n       https://nvd.nist.gov/vuln/detail/CVE-2019-17026\n[ 12 ] CVE-2019-20503\n       https://nvd.nist.gov/vuln/detail/CVE-2019-20503\n[ 13 ] CVE-2020-6796\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6796\n[ 14 ] CVE-2020-6797\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6797\n[ 15 ] CVE-2020-6798\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6798\n[ 16 ] CVE-2020-6799\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6799\n[ 17 ] CVE-2020-6800\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6800\n[ 18 ] CVE-2020-6805\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6805\n[ 19 ] CVE-2020-6806\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6806\n[ 20 ] CVE-2020-6807\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6807\n[ 21 ] CVE-2020-6811\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6811\n[ 22 ] CVE-2020-6812\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6812\n[ 23 ] CVE-2020-6814\n       https://nvd.nist.gov/vuln/detail/CVE-2020-6814\n[ 24 ] MFSA-2019-37\n       https://www.mozilla.org/en-US/security/advisories/mfsa2019-37/\n[ 25 ] MFSA-2020-03\n       https://www.mozilla.org/en-US/security/advisories/mfsa2020-03/\n[ 26 ] MFSA-2020-06\n       https://www.mozilla.org/en-US/security/advisories/mfsa2020-06/\n[ 27 ] MFSA-2020-09\n       https://www.mozilla.org/en-US/security/advisories/mfsa2020-09/\n\nAvailability\n============\n\nThis GLSA and any updates to it are available for viewing at\nthe Gentoo Security Website:\n\n https://security.gentoo.org/glsa/202003-02\n\nConcerns?\n=========\n\nSecurity is a primary focus of Gentoo Linux and ensuring the\nconfidentiality and security of our users\u0027 machines is of utmost\nimportance to us. Any security concerns should be addressed to\nsecurity@gentoo.org or alternatively, you may file a bug at\nhttps://bugs.gentoo.org. \n\nLicense\n=======\n\nCopyright 2020 Gentoo Foundation, Inc; referenced text\nbelongs to its owner(s). \n\nThe contents of this document are licensed under the\nCreative Commons - Attribution / Share Alike license. \n\nhttps://creativecommons.org/licenses/by-sa/2.5\n. \n-----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\n[slackware-security]  mozilla-firefox (SSA:2019-337-01)\n\nNew mozilla-firefox packages are available for Slackware 14.2 and -current to\nfix security issues. \n\n\nHere are the details from the Slackware 14.2 ChangeLog:\n+--------------------------+\npatches/packages/mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz:  Upgraded. \n  This release contains security fixes and improvements. \n  For more information, see:\n    https://www.mozilla.org/en-US/firefox/68.3.0/releasenotes/\n    https://www.mozilla.org/security/known-vulnerabilities/firefoxESR.html\n    https://www.mozilla.org/security/advisories/mfsa2019-37/\n    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17008\n    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13722\n    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11745\n    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17009\n    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17010\n    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17005\n    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17011\n    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17012\n  (* Security fix *)\n+--------------------------+\n\n\nWhere to find the new packages:\n+-----------------------------+\n\nThanks to the friendly folks at the OSU Open Source Lab\n(http://osuosl.org) for donating FTP and rsync hosting\nto the Slackware project!  :-)\n\nAlso see the \"Get Slack\" section on http://slackware.com for\nadditional mirror sites near you. \n\nUpdated package for Slackware 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz\n\nUpdated package for Slackware x86_64 14.2:\nftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mozilla-firefox-68.3.0esr-x86_64-1_slack14.2.txz\n\nUpdated package for Slackware -current:\nftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/mozilla-firefox-68.3.0esr-i686-1.txz\n\nUpdated package for Slackware x86_64 -current:\nftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/mozilla-firefox-68.3.0esr-x86_64-1.txz\n\n\nMD5 signatures:\n+-------------+\n\nSlackware 14.2 package:\n87f700f9d6e2f2714f34bd4df98daff3  mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz\n\nSlackware x86_64 14.2 package:\na1fc7f2d55d99552fbfef89c0a4fc4d8  mozilla-firefox-68.3.0esr-x86_64-1_slack14.2.txz\n\nSlackware -current package:\nb398fbd95c214bc1f209344809557650  xap/mozilla-firefox-68.3.0esr-i686-1.txz\n\nSlackware x86_64 -current package:\n54fdcfaa0337054003900c366020e39f  xap/mozilla-firefox-68.3.0esr-x86_64-1.txz\n\n\nInstallation instructions:\n+------------------------+\n\nUpgrade the package as root:\n# upgradepkg mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz\n\n\n+-----+\n\nSlackware Linux Security Team\nhttp://slackware.com/gpg-key\nsecurity@slackware.com\n\n+------------------------------------------------------------------------+\n| To leave the slackware-security mailing list:                          |\n+------------------------------------------------------------------------+\n| Send an email to majordomo@slackware.com with this text in the body of |\n| the email message:                                                     |\n|                                                                        |\n|   unsubscribe slackware-security                                       |\n|                                                                        |\n| You will get a confirmation message back containing instructions to    |\n| complete the process.  Please do not reply to this email address",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-11745"
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-11745"
      },
      {
        "db": "PACKETSTORM",
        "id": "156770"
      },
      {
        "db": "PACKETSTORM",
        "id": "155486"
      },
      {
        "db": "PACKETSTORM",
        "id": "157226"
      },
      {
        "db": "PACKETSTORM",
        "id": "157142"
      },
      {
        "db": "PACKETSTORM",
        "id": "156299"
      },
      {
        "db": "PACKETSTORM",
        "id": "156704"
      },
      {
        "db": "PACKETSTORM",
        "id": "155546"
      },
      {
        "db": "PACKETSTORM",
        "id": "155603"
      }
    ],
    "trust": 1.71
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2019-11745",
        "trust": 2.5
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-21-040-04",
        "trust": 1.7
      },
      {
        "db": "SIEMENS",
        "id": "SSA-379803",
        "trust": 1.7
      },
      {
        "db": "PACKETSTORM",
        "id": "156770",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "157226",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "157142",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "156704",
        "trust": 0.7
      },
      {
        "db": "PACKETSTORM",
        "id": "155546",
        "trust": 0.7
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4739",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4555",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0001",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.4083",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1339",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0483",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4449",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4723",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0307",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4579",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4507",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4775",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1173",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.3355",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4674",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4610",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1387",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.1242",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2021.0491",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0136",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2020.0194",
        "trust": 0.6
      },
      {
        "db": "AUSCERT",
        "id": "ESB-2019.4594",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "156721",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "156093",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "155487",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "155589",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "155989",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "157345",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "155622",
        "trust": 0.6
      },
      {
        "db": "NSFOCUS",
        "id": "47047",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371",
        "trust": 0.6
      },
      {
        "db": "VULMON",
        "id": "CVE-2019-11745",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "155486",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "156299",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "155603",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-11745"
      },
      {
        "db": "PACKETSTORM",
        "id": "156770"
      },
      {
        "db": "PACKETSTORM",
        "id": "155486"
      },
      {
        "db": "PACKETSTORM",
        "id": "157226"
      },
      {
        "db": "PACKETSTORM",
        "id": "157142"
      },
      {
        "db": "PACKETSTORM",
        "id": "156299"
      },
      {
        "db": "PACKETSTORM",
        "id": "156704"
      },
      {
        "db": "PACKETSTORM",
        "id": "155546"
      },
      {
        "db": "PACKETSTORM",
        "id": "155603"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "id": "VAR-202001-1433",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.52540106
  },
  "last_update_date": "2024-07-23T19:29:34.490000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Multiple Mozilla Product Buffer Error Vulnerability Fix",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=106677"
      },
      {
        "title": "Red Hat: Important: nss security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20200243 - security advisory"
      },
      {
        "title": "Red Hat: Important: nss-softokn security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20201461 - security advisory"
      },
      {
        "title": "Red Hat: Important: nss security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20194114 - security advisory"
      },
      {
        "title": "Red Hat: Important: nss-softokn security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20200466 - security advisory"
      },
      {
        "title": "Red Hat: Important: nss-softokn security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20194152 - security advisory"
      },
      {
        "title": "Red Hat: Important: nss, nss-softokn, nss-util security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20194190 - security advisory"
      },
      {
        "title": "Red Hat: Important: nss-softokn security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20201345 - security advisory"
      },
      {
        "title": "Red Hat: Important: nss-softokn security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20201267 - security advisory"
      },
      {
        "title": "Ubuntu Security Notice: nss vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4203-2"
      },
      {
        "title": "Ubuntu Security Notice: nss vulnerability",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4203-1"
      },
      {
        "title": "Debian Security Advisories: DSA-4579-1 nss -- security update",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=debian_security_advisories\u0026qid=0af759a984821af0886871e7a26a298e"
      },
      {
        "title": "Arch Linux Issues: ",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_issues\u0026qid=cve-2019-11745 log"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2020-1379",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=alas2-2020-1379"
      },
      {
        "title": "IBM: Security Bulletin: Vulnerability in nss, nss-softokn, nss-util vulnerability (CVE-2019-11729 and CVE-2019-11745)",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=74fd642ff4a4659039a762a5a0a24106"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2023-1942",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=alas2-2023-1942"
      },
      {
        "title": "Amazon Linux 2: ALAS2-2020-1384",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux2\u0026qid=alas2-2020-1384"
      },
      {
        "title": "Amazon Linux AMI: ALAS-2020-1355",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=amazon_linux_ami\u0026qid=alas-2020-1355"
      },
      {
        "title": "Ubuntu Security Notice: firefox vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4216-1"
      },
      {
        "title": "Arch Linux Advisories: [ASA-201912-2] thunderbird: arbitrary code execution",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=asa-201912-2"
      },
      {
        "title": "Ubuntu Security Notice: firefox vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4216-2"
      },
      {
        "title": "Ubuntu Security Notice: thunderbird vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4241-1"
      },
      {
        "title": "Mozilla: Security Vulnerabilities fixed in - Firefox ESR 68.3",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=940e53f5eecee1395e2713b0ed07506b"
      },
      {
        "title": "Mozilla: Security Vulnerabilities fixed in - Thunderbird 68.3",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=dffa374fab03b4f5b5596346629ccc8c"
      },
      {
        "title": "Arch Linux Advisories: [ASA-201912-1] firefox: multiple issues",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=arch_linux_advisories\u0026qid=asa-201912-1"
      },
      {
        "title": "Siemens Security Advisories: Siemens Security Advisory",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=siemens_security_advisories\u0026qid=409c1cd1b8ef401020956950fd839000"
      },
      {
        "title": "Mozilla: Security Vulnerabilities fixed in - Firefox 71",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=mozilla_advisories\u0026qid=a8e439d387c58595bbdb24cc3bdadd40"
      },
      {
        "title": "Ubuntu Security Notice: thunderbird vulnerabilities",
        "trust": 0.1,
        "url": "https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice\u0026qid=usn-4335-1"
      },
      {
        "title": "",
        "trust": 0.1,
        "url": "https://github.com/vincent-deng/veracode-container-security-finding-parser "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-11745"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-787",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.4,
        "url": "https://access.redhat.com/errata/rhsa-2020:0243"
      },
      {
        "trust": 2.4,
        "url": "https://access.redhat.com/errata/rhsa-2020:0466"
      },
      {
        "trust": 2.3,
        "url": "https://usn.ubuntu.com/4241-1/"
      },
      {
        "trust": 2.3,
        "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"
      },
      {
        "trust": 1.8,
        "url": "https://www.mozilla.org/security/advisories/mfsa2019-37/"
      },
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/202003-02"
      },
      {
        "trust": 1.8,
        "url": "https://security.gentoo.org/glsa/202003-37"
      },
      {
        "trust": 1.7,
        "url": "https://www.mozilla.org/security/advisories/mfsa2019-38/"
      },
      {
        "trust": 1.7,
        "url": "https://www.mozilla.org/security/advisories/mfsa2019-36/"
      },
      {
        "trust": 1.7,
        "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html"
      },
      {
        "trust": 1.7,
        "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html"
      },
      {
        "trust": 1.7,
        "url": "https://security.gentoo.org/glsa/202003-10"
      },
      {
        "trust": 1.7,
        "url": "https://usn.ubuntu.com/4335-1/"
      },
      {
        "trust": 1.7,
        "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html"
      },
      {
        "trust": 1.7,
        "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf"
      },
      {
        "trust": 1.4,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-11745"
      },
      {
        "trust": 0.7,
        "url": "https://usn.ubuntu.com/4203-2/"
      },
      {
        "trust": 0.7,
        "url": "https://usn.ubuntu.com/4203-1/"
      },
      {
        "trust": 0.6,
        "url": "https://usn.ubuntu.com/4216-2/"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/errata/rhsa-2019:4117"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193347-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193395-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.debian.org/security/2019/dsa-4579"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193339-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2019/suse-su-201914260-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.suse.com/support/update/announcement/2020/suse-su-20200088-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://lists.debian.org/debian-lts-announce/2019/11/msg00026.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.debian.org/lts/security/2019/dla-2020"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/errata/rhsa-2019:4152"
      },
      {
        "trust": 0.6,
        "url": "https://access.redhat.com/errata/rhsa-2019:4190"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/155589/red-hat-security-advisory-2019-4114-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4449/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-release-for-ibm-security-identity-governance-and-intelligence-in-response-to-security-vulnerabilities-cve-2019-11729-cve-2019-11745/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/155622/red-hat-security-advisory-2019-4190-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/155546/slackware-security-advisory-mozilla-firefox-updates.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0136/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/155487/ubuntu-security-notice-usn-4203-2.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-vulnerability-in-nss-nss-softokn-nss-util-vulnerability-cve-2019-11729-and-cve-2019-11745/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0483/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/156770/gentoo-linux-security-advisory-202003-37.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0194/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-mq-appliance-is-affected-by-network-security-services-nss-vulnerabilities-cve-2019-11729-and-cve-2019-11745/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.3355/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/157226/red-hat-security-advisory-2020-1461-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/155989/ubuntu-security-notice-usn-4241-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.4083"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/156093/red-hat-security-advisory-2020-0243-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/support/pages/node/6520674"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4739/"
      },
      {
        "trust": 0.6,
        "url": "https://vigilance.fr/vulnerability/mozilla-nss-buffer-overflow-via-nsc-encryptupdate-30971"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4507/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1339/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/157345/ubuntu-security-notice-usn-4335-1.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4579/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0307/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/157142/red-hat-security-advisory-2020-1345-01.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4775/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4555/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4610/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4723/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/156704/gentoo-linux-security-advisory-202003-02.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-privileged-identity-manager-is-affected-by-security-vulnerabilities/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4674/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.0001/"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-has-announced-a-release-for-ibm-security-identity-governance-and-intelligence-in-response-to-a-security-vulnerability-cve-2019-11745/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2019.4594/"
      },
      {
        "trust": 0.6,
        "url": "https://packetstormsecurity.com/files/156721/gentoo-linux-security-advisory-202003-10.html"
      },
      {
        "trust": 0.6,
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-identity-manager-virtual-appliance-is-affected-by-multiple-vulnerabilities/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2021.0491"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1173/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1242/"
      },
      {
        "trust": 0.6,
        "url": "https://www.auscert.org.au/bulletins/esb-2020.1387/"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/47047"
      },
      {
        "trust": 0.3,
        "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce"
      },
      {
        "trust": 0.3,
        "url": "https://bugzilla.redhat.com/):"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/team/key/"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/articles/11258"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/cve/cve-2019-11745"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/team/contact/"
      },
      {
        "trust": 0.3,
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "trust": 0.3,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17010"
      },
      {
        "trust": 0.2,
        "url": "https://bugs.gentoo.org."
      },
      {
        "trust": 0.2,
        "url": "https://creativecommons.org/licenses/by-sa/2.5"
      },
      {
        "trust": 0.2,
        "url": "https://security.gentoo.org/"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-0495"
      },
      {
        "trust": 0.2,
        "url": "https://access.redhat.com/security/cve/cve-2018-0495"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17008"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17011"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17005"
      },
      {
        "trust": 0.2,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17012"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/787.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-11696"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-11695"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2018-18508"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-11697"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-11698"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4203-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nss/2:3.35-2ubuntu2.5"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nss/2:3.42-1ubuntu2.3"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nss/2:3.45-1ubuntu2.1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/nss/2:3.28.4-0ubuntu0.16.04.8"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:1461"
      },
      {
        "trust": 0.1,
        "url": "https://access.redhat.com/errata/rhsa-2020:1345"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6814"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6798"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17026"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17022"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6799"
      },
      {
        "trust": 0.1,
        "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2020-09/"
      },
      {
        "trust": 0.1,
        "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2020-03/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6797"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6805"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17017"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17016"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6800"
      },
      {
        "trust": 0.1,
        "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2020-06/"
      },
      {
        "trust": 0.1,
        "url": "https://www.mozilla.org/en-us/security/advisories/mfsa2019-37/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17024"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6806"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-20503"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6796"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6811"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6807"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2020-6812"
      },
      {
        "trust": 0.1,
        "url": "http://slackware.com"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17010"
      },
      {
        "trust": 0.1,
        "url": "https://www.mozilla.org/security/known-vulnerabilities/firefoxesr.html"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-13722"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17008"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17011"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17005"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17009"
      },
      {
        "trust": 0.1,
        "url": "http://slackware.com/gpg-key"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-11745"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-13722"
      },
      {
        "trust": 0.1,
        "url": "http://osuosl.org)"
      },
      {
        "trust": 0.1,
        "url": "https://www.mozilla.org/en-us/firefox/68.3.0/releasenotes/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17009"
      },
      {
        "trust": 0.1,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17012"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/firefox/71.0+build5-0ubuntu0.18.04.1"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17014"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/firefox/71.0+build5-0ubuntu0.19.10.1"
      },
      {
        "trust": 0.1,
        "url": "https://usn.ubuntu.com/4216-1"
      },
      {
        "trust": 0.1,
        "url": "https://launchpad.net/ubuntu/+source/firefox/71.0+build5-0ubuntu0.19.04.1"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2019-11745"
      },
      {
        "db": "PACKETSTORM",
        "id": "156770"
      },
      {
        "db": "PACKETSTORM",
        "id": "155486"
      },
      {
        "db": "PACKETSTORM",
        "id": "157226"
      },
      {
        "db": "PACKETSTORM",
        "id": "157142"
      },
      {
        "db": "PACKETSTORM",
        "id": "156299"
      },
      {
        "db": "PACKETSTORM",
        "id": "156704"
      },
      {
        "db": "PACKETSTORM",
        "id": "155546"
      },
      {
        "db": "PACKETSTORM",
        "id": "155603"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2019-11745"
      },
      {
        "db": "PACKETSTORM",
        "id": "156770"
      },
      {
        "db": "PACKETSTORM",
        "id": "155486"
      },
      {
        "db": "PACKETSTORM",
        "id": "157226"
      },
      {
        "db": "PACKETSTORM",
        "id": "157142"
      },
      {
        "db": "PACKETSTORM",
        "id": "156299"
      },
      {
        "db": "PACKETSTORM",
        "id": "156704"
      },
      {
        "db": "PACKETSTORM",
        "id": "155546"
      },
      {
        "db": "PACKETSTORM",
        "id": "155603"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      },
      {
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2020-01-08T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-11745"
      },
      {
        "date": "2020-03-16T22:35:27",
        "db": "PACKETSTORM",
        "id": "156770"
      },
      {
        "date": "2019-11-28T01:22:35",
        "db": "PACKETSTORM",
        "id": "155486"
      },
      {
        "date": "2020-04-15T00:12:17",
        "db": "PACKETSTORM",
        "id": "157226"
      },
      {
        "date": "2020-04-07T16:41:47",
        "db": "PACKETSTORM",
        "id": "157142"
      },
      {
        "date": "2020-02-11T15:56:55",
        "db": "PACKETSTORM",
        "id": "156299"
      },
      {
        "date": "2020-03-12T20:16:23",
        "db": "PACKETSTORM",
        "id": "156704"
      },
      {
        "date": "2019-12-04T23:11:46",
        "db": "PACKETSTORM",
        "id": "155546"
      },
      {
        "date": "2019-12-09T23:42:22",
        "db": "PACKETSTORM",
        "id": "155603"
      },
      {
        "date": "2019-11-26T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      },
      {
        "date": "2020-01-08T20:15:12.313000",
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2021-02-19T00:00:00",
        "db": "VULMON",
        "id": "CVE-2019-11745"
      },
      {
        "date": "2021-12-03T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      },
      {
        "date": "2021-02-19T17:22:17.650000",
        "db": "NVD",
        "id": "CVE-2019-11745"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "155486"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Mozilla Firefox Buffer error vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201911-1371"
      }
    ],
    "trust": 0.6
  }
}

cve-2019-11745

Vulnerability from cvelistv5

Published

2020-01-08 19:22

Modified

2024-08-04 23:03

Severity ?

Summary

References

▼	URL	Tags
	https://www.mozilla.org/security/advisories/mfsa2019-36/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-38/	x_refsource_CONFIRM
	https://www.mozilla.org/security/advisories/mfsa2019-37/	x_refsource_CONFIRM
	https://bugzilla.mozilla.org/show_bug.cgi?id=1586176	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html	vendor-advisory, x_refsource_SUSE
	https://usn.ubuntu.com/4241-1/	vendor-advisory, x_refsource_UBUNTU
	https://access.redhat.com/errata/RHSA-2020:0243	vendor-advisory, x_refsource_REDHAT
	https://access.redhat.com/errata/RHSA-2020:0466	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-02	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/202003-10	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/202003-37	vendor-advisory, x_refsource_GENTOO
	https://usn.ubuntu.com/4335-1/	vendor-advisory, x_refsource_UBUNTU
	https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html	mailing-list, x_refsource_MLIST
	https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf	x_refsource_CONFIRM
	https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Mozilla

Thunderbird

Version: before 68.3

	Mozilla	Firefox ESR	Version: before 68.3
	Mozilla	Firefox	Version: before 71

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T23:03:32.560Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-36/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-38/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.mozilla.org/security/advisories/mfsa2019-37/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176"
          },
          {
            "name": "openSUSE-SU-2020:0003",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html"
          },
          {
            "name": "openSUSE-SU-2020:0002",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html"
          },
          {
            "name": "openSUSE-SU-2020:0008",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html"
          },
          {
            "name": "USN-4241-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4241-1/"
          },
          {
            "name": "RHSA-2020:0243",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0243"
          },
          {
            "name": "RHSA-2020:0466",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2020:0466"
          },
          {
            "name": "GLSA-202003-02",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-02"
          },
          {
            "name": "GLSA-202003-10",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-10"
          },
          {
            "name": "GLSA-202003-37",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202003-37"
          },
          {
            "name": "USN-4335-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "https://usn.ubuntu.com/4335-1/"
          },
          {
            "name": "[debian-lts-announce] 20200929 [SECURITY] [DLA 2388-1] nss security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Thunderbird",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.3"
            }
          ]
        },
        {
          "product": "Firefox ESR",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 68.3"
            }
          ]
        },
        {
          "product": "Firefox",
          "vendor": "Mozilla",
          "versions": [
            {
              "status": "affected",
              "version": "before 71"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Out of bounds write in NSS when encrypting with a block cipher",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-02-12T06:08:36",
        "orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
        "shortName": "mozilla"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-36/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-38/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.mozilla.org/security/advisories/mfsa2019-37/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176"
        },
        {
          "name": "openSUSE-SU-2020:0003",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html"
        },
        {
          "name": "openSUSE-SU-2020:0002",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html"
        },
        {
          "name": "openSUSE-SU-2020:0008",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html"
        },
        {
          "name": "USN-4241-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4241-1/"
        },
        {
          "name": "RHSA-2020:0243",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0243"
        },
        {
          "name": "RHSA-2020:0466",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2020:0466"
        },
        {
          "name": "GLSA-202003-02",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-02"
        },
        {
          "name": "GLSA-202003-10",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-10"
        },
        {
          "name": "GLSA-202003-37",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202003-37"
        },
        {
          "name": "USN-4335-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "https://usn.ubuntu.com/4335-1/"
        },
        {
          "name": "[debian-lts-announce] 20200929 [SECURITY] [DLA 2388-1] nss security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@mozilla.org",
          "ID": "CVE-2019-11745",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Thunderbird",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.3"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox ESR",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 68.3"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Firefox",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "before 71"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Mozilla"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "When encrypting with a block cipher, if a call to NSC_EncryptUpdate was made with data smaller than the block size, a small out of bounds write could occur. This could have caused heap corruption and a potentially exploitable crash. This vulnerability affects Thunderbird \u003c 68.3, Firefox ESR \u003c 68.3, and Firefox \u003c 71."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Out of bounds write in NSS when encrypting with a block cipher"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-36/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-36/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-38/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-38/"
            },
            {
              "name": "https://www.mozilla.org/security/advisories/mfsa2019-37/",
              "refsource": "CONFIRM",
              "url": "https://www.mozilla.org/security/advisories/mfsa2019-37/"
            },
            {
              "name": "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176",
              "refsource": "CONFIRM",
              "url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1586176"
            },
            {
              "name": "openSUSE-SU-2020:0003",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00000.html"
            },
            {
              "name": "openSUSE-SU-2020:0002",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00001.html"
            },
            {
              "name": "openSUSE-SU-2020:0008",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00006.html"
            },
            {
              "name": "USN-4241-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4241-1/"
            },
            {
              "name": "RHSA-2020:0243",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0243"
            },
            {
              "name": "RHSA-2020:0466",
              "refsource": "REDHAT",
              "url": "https://access.redhat.com/errata/RHSA-2020:0466"
            },
            {
              "name": "GLSA-202003-02",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-02"
            },
            {
              "name": "GLSA-202003-10",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-10"
            },
            {
              "name": "GLSA-202003-37",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202003-37"
            },
            {
              "name": "USN-4335-1",
              "refsource": "UBUNTU",
              "url": "https://usn.ubuntu.com/4335-1/"
            },
            {
              "name": "[debian-lts-announce] 20200929 [SECURITY] [DLA 2388-1] nss security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/09/msg00029.html"
            },
            {
              "name": "https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf",
              "refsource": "CONFIRM",
              "url": "https://cert-portal.siemens.com/productcert/pdf/ssa-379803.pdf"
            },
            {
              "name": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04",
              "refsource": "MISC",
              "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-040-04"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
    "assignerShortName": "mozilla",
    "cveId": "CVE-2019-11745",
    "datePublished": "2020-01-08T19:22:00",
    "dateReserved": "2019-05-03T00:00:00",
    "dateUpdated": "2024-08-04T23:03:32.560Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

var-202001-1433

Vulnerability from variot

Background

nss vulnerability

Synopsis

Background

Affected packages

Description

Impact

Workaround

Resolution

References

Availability

Concerns?

License

upgradepkg mozilla-firefox-68.3.0esr-i686-1_slack14.2.txz

cve-2019-11745

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature